{"id":1035,"date":"2026-05-25T07:44:13","date_gmt":"2026-05-25T07:44:13","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1035"},"modified":"2026-05-25T07:44:13","modified_gmt":"2026-05-25T07:44:13","slug":"trapdoor-supply-chain-attack-spreads-credential-stealing-malware-via-npm-pypi-and-cratesio","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1035","title":{"rendered":"TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjOb58wXNPgRDazHcSLTObawPnMVsCDUEAoFclGVn3CC8qe6Pr_0-Gce-SxCO7FJ5HzU23WE_soU5iTc0zvLL0zzbXPcO8MqVgHIIAKXJo4ExcujDPV9yiIdN1X1jV63ACBN66_ktTeQ0FVmYsCTJC3tpyxpUBrvxLh_xqF-mKOZy8uaqz3QKyf6XpJHC4z\/s1700-e365\/npm-python-rust.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware.<\/p>\n<p>The campaign, codenamed <b><a href=\"https:\/\/socket.dev\/blog\/trapdoor-crypto-stealer-npm-pypi-crates\">TrapDoor<\/a><\/b>, spans more than 34 malicious packages across over 384 versions. The earliest activity was recorded on May 22, 2026, at 8:20 p.m. UTC, with new packages published to the ecosystems in waves from a cluster of accounts in quick succession.<\/p>\n<p>\u00abTrapDoor targets developers in crypto, DeFi, Solana, and AI communities,\u00bb Socket said. \u00abThe malicious packages are designed to steal developer secrets, crypto wallets, SSH keys, cloud credentials, browser data, and environment variables.\u00bb<\/p>\n<p>\u00abSeveral npm packages also deploy a shared payload, trap-core.js, that scans for credentials, validates AWS and GitHub tokens, attempts SSH-based lateral movement, and plants persistence through .cursorrules, CLAUDE.md, Git hooks, shell hooks, systemd, cron, and SSH.\u00bb<\/p>\n<p>It&#8217;s worth noting that the activity has no connection to another campaign of the same name that HUMAN&#8217;s Satori Threat Intelligence and Research Team detailed last week as engaging in ad fraud by distributing 455 Android apps through the Google Play Store.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/threatlabz-vpn-risk-2026-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhnNON5UeWywT7OcPNw7V4L7QNWnCnm7Xl_99Y9ek8dL-gRwx-bWxQM1TKqt8deqqrdpUyKMuuijAWyyPQVB0s0qf8ntQ6ldFAJLru-QUWhddKTopc7SeNbBBnd-TsfFyRPP-AAyDuclLlL6XHK4_LXqDC_7eyaz9pzToYr7U543MhrJ7qcK-89sVWHTQUZ\/s728-e100\/zz-2-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The <a href=\"https:\/\/socket.dev\/supply-chain-attacks\/trapdoor-crypto-stealer\">list of identified packages<\/a> is below &#8211;<\/p>\n<ul>\n<li>\n    Crates.io<\/p>\n<ul>\n<li>move-analyzer-build<\/li>\n<li>move-compiler-tools<\/li>\n<li>move-project-builder<\/li>\n<li>sui-framework-helpers<\/li>\n<li>sui-move-build-helper<\/li>\n<li>sui-sdk-build-utils<\/li>\n<\/ul>\n<\/li>\n<li>\n    npm<\/p>\n<ul>\n<li>async-pipeline-builder<\/li>\n<li>build-scripts-utils<\/li>\n<li>chain-key-validator<\/li>\n<li>crypto-credential-scanner<\/li>\n<li>defi-env-auditor<\/li>\n<li>defi-threat-scanner<\/li>\n<li>deployment-key-auditor<\/li>\n<li>dev-env-bootstrapper<\/li>\n<li>eth-wallet-sentinel<\/li>\n<li>llm-context-compressor<\/li>\n<li>mnemonic-safety-check<\/li>\n<li>model-switch-router<\/li>\n<li>node-setup-helpers<\/li>\n<li>project-init-tools<\/li>\n<li>prompt-engineering-toolkit<\/li>\n<li>solidity-deploy-guard<\/li>\n<li>token-usage-tracker<\/li>\n<li>wallet-backup-verifier<\/li>\n<li>wallet-security-checker<\/li>\n<li>web3-secrets-detector<\/li>\n<li>workspace-config-loader<\/li>\n<\/ul>\n<\/li>\n<li>\n    PyPI<\/p>\n<ul>\n<li>cryptowallet-safety<\/li>\n<li>data-pipeline-check<\/li>\n<li>defi-risk-scanner<\/li>\n<li>env-loader-cli<\/li>\n<li>eth-security-auditor<\/li>\n<li>git-config-sync<\/li>\n<li>solidity-build-guard<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>The operation is notable for its diverse delivery paths, using postinstall hooks, remote JavaScript payloads that are executed during package imports, and malicious build.rs scripts to target Sui and Move developers. The packages masquerade as seemingly harmless tools, giving attackers the ability to reach a broad audience.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>The npm packages have been found to run a JavaScript payload (\u00abtrap-core.js\u00bb), which scans for credentials and developer secrets, validates stolen credentials using AWS and GitHub API calls, and creates persistence on the host using cron jobs, systemd services, Git hooks, and moves across the network via SSH.<\/p>\n<p>The Rust crates, in a similar fashion, search for local keystores, encrypt the data using a hardcoded XOR key, and exfiltrate it to GitHub Gists. The packages are also noteworthy for the use of a <a href=\"https:\/\/doc.rust-lang.org\/cargo\/reference\/build-scripts.html\">build script<\/a> (\u00abbuild.rs\u00bb) to trigger the execution of the malicious code.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-cant-stop-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjPEV6-530TOlxG6PjrmdlY623wpBwduZ7t1HV6flcmO5R4q4AmfixDUzW0CrhlvMVNWbhvOIso-UDNTka4W_W9Chrdj_dglwBZwi7DuePM2IMIl-hfUYVIqBXgfpr_2619K8Gptb4LzwJ6gUbi7lWl2M8AFQJsHEaw63Q7tZ6708YGruiHrr0Y2W9YYxLQ\/s728-e100\/ThreatLocker-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The Python packages associated with TrapDoor are designed such that they are auto-executed on import. The primary goal of the packages is to download JavaScript from an attacker-controlled GitHub Pages domain (\u00abddjidd564.github[.]io\u00bb), and run it using \u00abnode -e.\u00bb<\/p>\n<p>\u00abThis technique allows the Python package to delegate execution to a remote JavaScript payload, giving the attacker more flexibility after publication,\u00bb Socket explained. \u00abBy hosting the payload externally, the attacker can update behavior without publishing a new PyPI release.\u00bb<\/p>\n<p>An unusual aspect of the campaign is the implanting of .cursorrules and CLAUDE.md containing hidden instructions to trick artificial intelligence (AI) assistants into running a \u00absecurity scan\u00bb that results in secret discovery and exfiltration. This is achieved by opening GitHub pull requests (PRs) across popular AI and developer projects, including \u00abbrowser-use\/browser-use,\u00bb \u00ablangchain-ai\/langchain,\u00bb and \u00ablangflow-ai\/langflow.\u00bb<\/p>\n<p>The PR activity indicates that TrapDoor extends beyond pushing malicious packages to open-source ecosystems. Socket said the threat actor is likely testing whether AI-related project files can be introduced through regular open-source contribution workflows, thereby causing AI coding tools to parse those hidden instructions and apply them.<\/p>\n<p>The findings once again demonstrate how threat actors are increasingly targeting developer workflows, aiming to steal a wide range of information that could make it possible to burrow deeper into target environments for follow-on attacks.<\/p>\n<p>\u00abTrapDoor shows how attackers are combining traditional package typosquatting with newer developer-environment attack paths,\u00bb Socket said. \u00abThe package names are tailored to appear relevant to crypto development, AI tooling, local environment setup, and security workflows. The malware then uses ecosystem-specific execution paths: build.rs in Rust, postinstall hooks in npm, and import-time execution in Python.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware. The campaign, codenamed TrapDoor, spans more than 34 malicious packages across&hellip;<\/p>\n","protected":false},"author":1,"featured_media":1036,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[220,219,1782,642,42,39,934,666,218,1732],"class_list":["post-1035","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-attack","tag-chain","tag-cratesio","tag-credentialstealing","tag-malware","tag-npm","tag-pypi","tag-spreads","tag-supply","tag-trapdoor"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1035"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1035\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1036"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}